Data Governance And Compliance practice questions

User's Drive settings

Why it fails: Users cannot access global audit logs.

DLP incident reports

Why it fails: DLP reports only cover policy violations.

Google Vault Matters

Why it fails: Vault is for retention, not general audit activity reporting.

Manually run a data export in Vault

Why it fails: Vault exports copy data out for eDiscovery; they do not relocate a user's stored data between regions. It tempts because Vault surfaces where data resides, but migration is triggered by changing the user's region assignment, which prompts Google to move existing data automatically.

Re-provision the user account

Why it fails: Re-provisioning deletes and recreates the account, losing the user's existing data rather than migrating it. It tempts because region assignment follows the account, but the actual trigger is updating the user's location in the Data Region policy, which initiates the move without deletion.

Contact Google Support to initiate a manual migration

Why it fails: Support cannot manually relocate a user's data between regions; the migration is automated once the user's region assignment changes. It tempts because support handles complex data-governance cases, but the correct action is reassigning the user's location in the Data Region policy, which triggers the move.

Context-aware access

Why it fails: This is for access control, not message content filtering.

Gmail routing rules

Why it fails: Routing rules change the destination of mail, not the content blocking.

Vault hold

Why it fails: Vault is for preservation, not active filtering of mail.

Vault retention rules

Why it fails: Vault retention rules govern how long Gmail, Drive and Chat content is preserved for legal or compliance purposes; they sit inside Vault, not the Security Centre. Security Centre covers dashboard, investigation tool and health reporting, so retention policy belongs to a different console entirely.

DLP policy configuration

Why it fails: DLP is managed in Apps > Google Workspace > Drive/Gmail, not in the Security Center dashboard.

Admin audit logs

Why it fails: While some events are here, the investigation tool is the specialized UI for this data.

Reports dashboard

Why it fails: The dashboard shows trends, not specific user-level policy violations.

Vault matters

Why it fails: Vault does not report on DLP violations.

User password history

Why it fails: Password history is an account-security attribute, not a content or access criterion, so it cannot match messages or files in a DLP rule. It is tempting because it appears in password-policy configuration, where it correctly prevents reuse; that belongs to identity hardening, not data-loss inspection.

Network latency

Why it fails: Network latency is a transport performance metric, absent from DLP rule criteria, which evaluate content, sender, recipient and access level. It is tempting because latency matters in network troubleshooting and monitoring, where it would be the right measurement, but it cannot classify data for loss prevention.

Configure a Drive sharing setting that prevents files from being shared outside the Finance department, and rely on users to add labels.

Why it fails: Sharing settings can restrict external sharing but cannot automatically identify files containing credit card numbers or apply labels. This approach still requires manual labeling and does not ensure that only Finance users can access the files, as internal sharing could still occur.

Create a Drive label named "Confidential" and instruct users to apply it manually to files containing credit card numbers.

Why it fails: Manual labeling relies on users to identify and label sensitive content, which is error-prone and does not scale. The scenario explicitly requires automatic labeling, so this approach fails to meet the compliance requirement and could lead to unlabeled files being improperly shared.

Use Google Vault to search for files with credit card numbers and then apply the "Confidential" label to the search results.

Why it fails: Vault is designed for eDiscovery and retention, not for real-time content classification or labeling. While you can search for files, Vault does not provide a mechanism to automatically apply labels based on content, and it cannot enforce access restrictions dynamically.

Use Google Vault to retain all emails and then manually review them for PHI before sending.

Why it fails: Vault is for retention and eDiscovery, not for real-time email inspection or blocking. Manual review before sending is impractical and not scalable. Vault cannot prevent emails from being sent; it only archives them after the fact.

Configure a content compliance rule that adds a footer to all outgoing emails stating that they contain PHI.

Why it fails: Adding a footer does not prevent PHI from being sent externally; it only provides a disclaimer. This does not meet the compliance requirement to block PHI from leaving. Content compliance rules can modify messages but are not designed for data loss prevention.

Set up a Gmail setting to restrict external recipients to only those in a whitelist of partners.

Why it fails: Restricting external recipients to a whitelist would block all external emails, including legitimate business emails to partners not on the list. This is too broad and does not specifically target PHI. It would disrupt business communications and is not a targeted DLP solution.

Use a Google Vault retention rule to classify files based on content and apply a label.

Why it fails: Vault retention rules are used for data retention and eDiscovery, not for classification or labeling of files. Vault does not apply labels to files in Drive; it only preserves and holds data for legal purposes. Therefore, it cannot enforce content-based labeling or prevent label changes.

Configure an alert in the Security Center for files uploaded to the shared drive, and manually apply labels.

Why it fails: Alerts in the Security Center notify administrators of specific activities but do not automatically apply labels. Manual application is not scalable and does not prevent users from changing labels. This approach does not enforce the policy automatically and relies on human intervention, which is error-prone.

Set up a Drive label with 'restricted' access and enable 'Lock labels' in the label's properties.

Why it fails: While Drive labels can be locked, they do not automatically apply based on file content. Labels must be applied manually or via DLP rules. Simply creating a label with locked properties does not trigger automatic application to new uploads, so it fails to meet the requirement of content-based classification.

Create a Gmail retention rule for the Sales OU with the action 'Retain messages' and set the retention period to the maximum allowed (e.g., forever).

Why it fails: While retaining messages forever prevents automatic deletion, it does not prevent users or admins from manually deleting messages. The legal hold requirement needs a rule that stops deletion entirely. A retain rule still allows deletion from the user's mailbox, and after the retention period, messages could be purged if the rule is later changed.

Create a Gmail retention rule for the Sales OU with a specific retention period, and set the action to 'Expunge messages permanently'.

Why it fails: This rule would permanently delete messages after the retention period, which directly violates the legal hold requirement. Even with a long retention period, the rule eventually expunges messages, and users or admins could still delete them before the period ends. The scenario demands prevention of permanent deletion, not automatic deletion after a set time.

Place a legal hold on all users in the Sales OU using Google Vault, and instruct users not to delete any emails.

Why it fails: Google Vault holds preserve data for discovery but do not prevent users from deleting messages from their own mailboxes. Users can still move messages to Trash and empty it, though Vault retains a copy. The requirement is to prevent permanent deletion entirely, which a hold does not do; it only ensures a copy remains for eDiscovery.

Google Workspace Alert Center

Why it fails: Alert Center provides alerts for potential security issues, such as suspicious sharing, but it does not provide a comprehensive timeline of all sharing events. It is more for notifications than for detailed investigation of historical sharing activities.

Admin Console audit log for Drive

Why it fails: The Drive audit log in the Admin Console does record sharing events, but it is not as user-friendly for timeline analysis and may not provide the same level of detail as Security Center. Security Center is specifically designed for security investigations and aggregates data more effectively.

Google Vault

Why it fails: Vault is used for retention and eDiscovery of user data, such as emails and Drive files, but it does not provide a timeline of sharing events. It can search for files but does not show sharing activities or recipients. It is not designed for security investigations of sharing behavior.

Security Center

Why it fails: Security Center provides security analytics and threat detection, such as alerts on suspicious activity. It does not provide a way to search for and export user data content. It is focused on security posture, not compliance data retrieval, so it is not appropriate for DSARs.

Admin Console Reporting

Why it fails: Admin Console reporting provides audit logs and usage reports, but it does not allow you to search for and export user-generated content like emails or files. It is used for monitoring activities, not for retrieving data for DSARs. Therefore, it is not suitable for this requirement.

Drive audit log

Why it fails: Drive audit logs record actions performed on files, such as sharing or deletion, but they do not contain the actual file content. They cannot be used to export user data for a DSAR. Audit logs are for monitoring, not for data retrieval, so this option is incorrect.

Create a Gmail content compliance rule that quarantines messages containing the financial terms, and set the retention period to 7 years.

Why it fails: Content compliance rules are used for scanning and taking actions like quarantine or rejection, but they do not provide retention. Retention is configured separately via Gmail retention rules. Quarantining messages would prevent delivery, which is not the goal; the requirement is to retain messages, not block them. This option confuses compliance rules with retention rules.

Configure a Gmail routing rule to send a copy of messages containing the financial terms to a designated compliance mailbox, and set that mailbox to retain messages for 7 years.

Why it fails: Routing rules can send copies to another mailbox, but they do not guarantee retention for 7 years; the recipient mailbox would need its own retention policy. This approach is indirect and error-prone, as users could delete the original message and the copy might not be preserved if the compliance mailbox is not properly configured. It does not meet the requirement for automatic retention of the original messages.

Use Google Vault to create a retention rule for Gmail with a custom retention period of 7 years, and set the scope to all users.

Why it fails: Google Vault retention rules can retain messages for a specified period, but they cannot filter by content terms; they apply to all messages or specific organizational units. To target specific financial terms, you need a Gmail retention rule with content conditions, which Vault does not support. Vault is for eDiscovery and holds, not content-based retention.

Suspend the user's account in the Admin Console.

Why it fails: Suspending an account prevents login but does not guarantee data retention. Administrators can still delete the account and its data. Suspension alone does not enforce a retention period, so it does not meet the requirement to preserve data for 7 years.

Create a custom retention policy in Google Drive for the user's files.

Why it fails: Google Drive retention policies can be set for files, but they do not cover Gmail data. The requirement includes both email and Drive data. Additionally, Drive retention policies are managed in Vault, not separately. A custom policy in Drive alone would not satisfy the need to retain Gmail data for 7 years.

Place a legal hold on the user's account in Vault.

Why it fails: A legal hold in Vault preserves data indefinitely, but it is typically used for specific matters and does not have a set expiration. The requirement is for 7 years, not indefinitely. While a legal hold would preserve the data, it does not automatically release after 7 years, which could lead to over-retention and potential compliance issues.

Change the user's profile country to the United States, and the Data Region will automatically update to keep data in the EU.

Why it fails: Changing the profile country does not control Data Region placement. Data Regions are determined by the organizational unit's policy, not the user's profile location. The profile country is used for other purposes like localization, but it does not trigger data migration or change data residency.

No action is needed; Data Regions automatically follow the user regardless of their physical location.

Why it fails: Data Regions do not automatically follow the user. They are tied to the organizational unit and the policies applied to it. If the user's OU changes, the Data Region may change. Additionally, new data may be stored in the region where the user is located if the policy is not correctly applied. Therefore, action is required to maintain EU residency.

Disable Data Regions for the user, allow data to be stored globally, and then re-enable EU Data Region to force migration.

Why it fails: Disabling Data Regions would temporarily allow data to be stored globally, which violates compliance. Re-enabling might not automatically migrate existing data; a manual migration is required. This approach risks data being stored outside the EU during the disabled period, which is unacceptable.

Configure a Drive sharing setting to 'On - Files can be shared outside your domain' and enable alerts for sharing changes.

Why it fails: Changing the sharing setting to allow external sharing does not generate alerts. The setting only controls whether sharing is permitted; it does not notify anyone when sharing occurs. Enabling alerts for sharing changes is not a feature of the sharing settings page. This option confuses permission configuration with monitoring.

Use the Security Investigation tool to run a search for external shares and schedule a daily export to the compliance officer.

Why it fails: The Security Investigation tool allows you to search for external shares, but it does not automatically notify or create alerts in the alert center. Scheduling an export would require manual setup and would not provide real-time notification. This method is reactive and does not meet the proactive alerting requirement.

Set up a Gmail content compliance rule that scans for Drive links in emails and notifies the compliance officer.

Why it fails: A Gmail content compliance rule inspects email messages, not Drive sharing actions. It would only catch cases where a Drive link is sent via Gmail, missing shares made through Drive directly or other channels. This approach does not provide the required coverage for all external sharing events.

Export all data to a PST file

Why it fails: Exporting to PST creates a single file that is hard to search, index, and audit, and risks corruption or loss over seven years. Google Vault retains the user's Gmail, Drive, and Chat data under legal hold with defined retention rules. PST export suits small one-off migrations, not long-term compliance retention.

Transfer Drive ownership to another user

Why it fails: Transferring Drive ownership preserves files but leaves the mailbox and other Workspace data unmanaged, and the new owner can delete or alter content at will. Ownership transfer suits a departing employee whose active documents must continue under a colleague.

Suspend the user account and keep it

Why it fails: Suspending the account blocks sign-in but retains the mailbox and Drive indefinitely, so it neither enforces the 7-year retention period nor frees the paid licence. Suspension suits temporary leave or investigation holds, where access must stop but the identity is expected to return.

Context-aware access

Why it fails: Context-aware access grants or blocks access to apps based on user identity, device and location signals; it cannot inspect message bodies for card numbers. It tempts because it enforces access policy, which would be correct for restricting Drive or Gmail access from unmanaged devices, not content matching.

Google Vault retention rules

Why it fails: Vault retention rules preserve and hold messages for eDiscovery and legal purposes; they neither scan content nor block sending. It tempts because Vault covers Gmail data governance, which would be correct for retaining or searching mail, but prevention requires content compliance rules with a card-number pattern.

Security center investigation tool

Why it fails: The investigation tool queries historical logs and takes remediation actions on past events; it cannot intercept a message at send time. It tempts because Security centre surfaces Gmail activity, which would be right for hunting prior incidents, but blocking card numbers requires a content compliance rule.

Endpoint management

Why it fails: Endpoint management configures device compliance and screen locks, not file-sharing boundaries; sharing restrictions live in Drive and Shared Drive policies. It is tempting because endpoint management does govern device-level data handling, and would be correct if the requirement were blocking downloads onto unmanaged devices.

Vault retention settings

Why it fails: Vault retention settings govern how long data is preserved for eDiscovery and legal hold, not whether sharing is permitted. It is tempting because Vault is the Workspace compliance tool, and would be correct if the requirement were retaining or holding messages and files rather than blocking external sharing.

App access control

Why it fails: App access control governs which third-party OAuth apps may reach Workspace data, not whether users can share files externally. It is tempting because it does control data exposure, and would be correct if the risk were an unauthorised marketplace app exfiltrating Drive content.

Enable endpoint management

Why it fails: Endpoint management covers device configuration and compliance, not mailbox retention; it cannot preserve messages once a user empties trash. It is tempting because it is an admin-level control, and would be correct when enforcing device policies or wiping corporate laptops remotely.

Use an Admin Console report

Why it fails: Admin Console reports only display existing data; they neither retain nor restore messages deleted from trash. It is tempting because reports are an admin visibility tool, and would be correct when auditing mailbox usage or investigating message activity, not enforcing a three-year retention period.

Configure a Gmail filter

Why it fails: A Gmail filter acts on incoming or existing messages at delivery, so it cannot intercept items after a user permanently deletes them from trash. It is tempting because filters automate mailbox handling, and would be correct for routing, labelling or archiving messages as they arrive.